CVE-2026-16577

Name of the Vulnerable Software and Affected Versions Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14

Description The plugin fails to validate a client-supplied payment amount against the vendor's actual outstanding balance during the recording of a reverse-withdrawal payment. This allows a vendor to credit their reverse-withdrawal ledger with an arbitrary amount, effectively clearing their commission debt without making the actual payment.

Recommendations Update the plugin to version 5.0.14 or later.